Privacy Policy

Account information. When you sign up we collect your email address and password (handled by our authentication provider, Supabase; we never see or store your plain-text password) and a username. We generate a random username for you (it is not derived from your email address), and you can change it at any time from your account page. Your username is shown publicly on your brackets, so please choose one you are comfortable showing.

Notification emails. If you create a bracket with timed rounds, we email the address on your account when one of its rounds closes and when the bracket finishes. Each email contains the bracket title, the round results or the champion, vote totals per matchup and links to the bracket and its share card. It never contains voter emails or voter identifiers. We keep a short log (the bracket, the round and whether the email went out, but not your email address) so we never send the same one twice. This is on by default and you can switch it off at any time (section 6).

Content you create. Brackets, titles, descriptions, entrant names, theme colors, round timing (manual close or a per-round duration, plus a tie-break setting and when each round opened or closed), links to images hosted elsewhere, and image files you upload for entrants (and, for Pro creators, a custom logo — uploaded or linked). Published brackets are public to anyone with the link, unless the creator protects them with a password (a Pro feature).

Images. If you upload an image we store a resized square copy (about 512 pixels) in Supabase Storage. Anyone who can view the bracket can see those images. The files sit in a public storage bucket, so anyone who has the direct image URL can load the file even if the bracket itself is password-protected. If you paste a link to an image hosted on another website instead, that image loads directly from that website into the browser of everyone who views the bracket, so that website can see those viewers' IP addresses and browser details.

Votes. When you vote we record which entrant you chose in which match, the time of the vote, a salted one-way hash of your IP address, a salted one-way hash of a random voter cookie we set in your browser, and a salted one-way hash of your IP network prefix (an IPv4 /24 or IPv6 /64). We use those hashes only to limit each person to one vote per match and to help creators spot clustered or scripted voting. We do not store your raw IP address in our database. The hashes are pseudonymous identifiers, not anonymous ones, so we treat them as personal information. Voters do not need an account, and a vote is not linked to your BracketBolt account even if you are signed in.

Optional voter email. A bracket creator on a Pro plan can require voters to enter an email address before voting. If you vote in such a bracket, your email is stored with your vote and the creator of that bracket can access it. The bracket will tell you before you vote. Do not enter an email address you do not want that creator to have.

Twitch and YouTube chat votes. A creator can connect their own Twitch and/or YouTube account to a bracket they own so viewers can vote by typing !1 or !2 (or !left / !right) in that channel's chat. When you vote that way we store a salted one-way hash of your platform user id (Twitch user id or YouTube channel id) with the vote, plus a source tag (twitch or youtube), so we can limit you to one vote per open match. We do not store your chat handle on the vote itself. We keep one overwritten “last seen” line on the creator's connection record (your display name and the command, for example coolviewer · !1) so the creator can see that chat voting is working. We do not keep a history of chatter identities. Connecting a channel stores the creator's OAuth tokens encrypted on our server; refresh tokens are never sent to the browser.

What creators can see. Bracket creators can see vote counts for their own brackets and, where email capture is enabled, the voter email addresses entered on them. They can also see truncated hashes of the voter identifiers above, and may disqualify a cluster of votes (for example many votes from the same network hash) so those votes stop counting. The owner of a bracket can open an analytics dashboard and download a CSV of the same aggregates: total votes, a best-effort unique-voter count from those fingerprints, web vs Twitch vs YouTube counts, and votes per match and option. That CSV does not include emails or hashes. We never store your raw IP address, so creators cannot see it. If they connected chat voting they can see the connected channel name, whether chat is live, and the most recent chatter display name and command — not a list of every chatter.

Payment information. If you buy BracketBolt Pro, payment is handled by our billing providers (see section 4). We send them your account ID and email address so they can set up and manage your subscription and send receipts. We receive your subscription status, plan and renewal dates, but not your full card number.

Technical data. Like most websites, our hosting and database providers process standard request information such as IP address, browser type, pages requested and timestamps, for security, reliability and debugging.

Approximate location. Our host (Vercel) tells our servers which country a request appears to come from. We use it only on the fly to decide whether to ask for your advertising choice before showing ads (see section 3). We do not store it.

• To provide the service: sign-in, creating brackets, counting votes, advancing winners, showing live results, and showing owners their own vote totals.
• To prevent abuse, such as repeat voting, scripted voting and spam, including short-lived rate-limit counters keyed by a hashed IP and (for votes) the bracket or match.
• To process Pro subscriptions and unlock Pro features.
• To send the sign-up confirmation email, the round-closed and bracket-finished notification emails described in section 1, and to reply to support requests.
• To decide whether to show the advertising space on brackets created by free-plan users (see section 3).
• To maintain, secure and improve BracketBolt.

We do not sell your personal information, and we do not use voter emails for our own marketing.

We use a small number of cookies and browser storage:

• Authentication session cookies (set by Supabase) keep you signed in. They are strictly necessary for logged-in features.
• Bracket access cookie (named like bk_access_<bracket id>) is set after you enter the correct password for a password-protected bracket, so you can keep viewing and voting in it. It lasts 7 days.
• Voter cookie (bk_voter) is a random identifier, signed by our server, used only to stop the same browser voting twice in a match even if your IP address changes. It is httpOnly, lasts 12 months, and we store only a salted hash of it with your vote, not the cookie value itself.
• Local storage in your browser may remember the email address you entered to vote in a bracket that requires one, so you are not asked again. You can clear it in your browser settings.
• Preference cookie (bb_consent, mirrored in your browser's local storage) remembers your cookie and advertising choice for 12 months. It is set only when you make a choice.
• Payment tools. When you open the Pro upgrade or checkout, scripts from our billing providers (RevenueCat and Stripe) run in your browser and may use their own cookies or browser storage to process the payment and prevent fraud. They are not loaded for other visitors.
• Cloudflare Turnstile (optional). If we have enabled it, after several votes from the same hashed IP we may ask you to complete a “confirm you are human” check before further votes are counted. That loads a script from Cloudflare and sends Cloudflare the check token (and, when we verify it, your IP address). If Turnstile is not enabled, that script is not loaded and voting works as before.

Advertising. We do not currently show ads: no advertising space is shown, no third-party advertising network is integrated, and no advertising cookies are set. If you record an advertising preference with “Cookie & ad preferences” in the footer of every page, it is stored as described above and will apply if we introduce ads later. We will update this policy before ads are introduced.

You can also block or delete cookies in your browser settings; some features, such as staying signed in, may stop working. We do not currently respond to browser “Do Not Track” signals; use the preferences link above instead.

We use these service providers to run BracketBolt. They process information on our behalf:

• Supabase - database, authentication, file storage for uploaded images, live vote updates and sign-up emails (stores accounts, brackets, votes and uploaded image files). Your browser connects to Supabase directly to sign in and to receive live results.
• Our email delivery provider - sends the notification emails described in section 1. It receives your email address and the content of the email (bracket title, results and links), and nothing about the people who voted.
• Vercel - website hosting and delivery (processes request data such as IP addresses and the country of the request).
• RevenueCat - subscription management and entitlement checks for BracketBolt Pro (receives your account ID and email address).
• Stripe (through RevenueCat Web Billing) - card payment processing.
• Cloudflare - only if we have enabled Turnstile for voting. Cloudflare then processes the CAPTCHA token and the IP address we send when we verify it. If Turnstile is not enabled, we do not send voting data to Cloudflare.
• Twitch - only if a creator connects Twitch chat voting. Twitch then sends that channel's chat messages to us (via EventSub) so we can count !1 / !2 votes. We send Twitch the creator's OAuth tokens to create and refresh that subscription. We do not send other voters' data to Twitch.
• Google / YouTube - only if a creator connects YouTube chat voting. We call the YouTube Data API with the creator's OAuth token to read live chat while they have a listen session open. We do not send other voters' data to Google.
• Advertising network - none is currently integrated, so no information is shared with one.

Other people and websites. Your username and brackets are public. Voter emails go to the creator of the bracket you vote in (section 1). Images you upload are served from our storage. Images you only link to load from the other website.

We may also disclose information if required by law, to protect the rights, safety or security of our users or the service, or as part of a merger or sale of the business. Our providers may process data in the United States and other countries. Where GDPR or UK law requires it, transfers rely on safeguards such as the EU-US Data Privacy Framework or Standard Contractual Clauses provided by those providers.

• Account and profile data: until you delete your account.
• Notification email log and your email notification setting: until the bracket or your account is deleted.
• Brackets, entrants, matches and the votes cast on them: until you delete the bracket from your account or the bracket's edit screen, until the account is deleted, or until we delete a bracket at the creator's request.
• Uploaded image files: until you delete your account. We remove those files from storage when the account is deleted. Deleting a single bracket removes it from the site but does not currently delete leftover image files; they are removed with the account.
• Votes you cast as a voter: they are not linked to an account, so deleting your account does not remove them from other people's brackets. They stay until that bracket or its creator's account is deleted. Voter emails can be deleted on request.
• Billing records: held by RevenueCat and Stripe for as long as tax, accounting and legal rules require, even after you delete your account.
• Rate-limit counters (hashed IP plus the route, bracket or match they apply to): kept only for the current rate-limit window, typically minutes to an hour, then replaced.
• Server and security logs: kept by our hosting and database providers on their own schedules.
• Cookies and browser storage: as described in section 3 (for example 12 months for your preference cookie and the voter cookie, and 7 days for a bracket access cookie).

When you delete a bracket we delete that bracket, its entrants, matches and votes on it from our database right away. When you delete your account we delete your profile, brackets, entrants, matches and votes on them from our database right away, and we delete image files you uploaded to our storage. Backups kept by our providers may hold deleted data for a limited time before they expire.

Delete a bracket. From your account page or the bracket's edit screen, choose Delete and confirm. That removes the bracket, its matches and votes. Links to it stop working. Uploaded images stay until you delete your account.

Delete your account yourself. Go to your account page, choose “Delete account” and type DELETE to confirm. This is permanent. When you confirm:

• your profile, username and every bracket you created, with its entrants, matches and votes, are deleted from our database, image files you uploaded are removed from our storage, and links to those brackets stop working;
• if you have a Pro subscription billed through RevenueCat Web Billing, we ask RevenueCat to cancel it so it will not renew, and to delete your customer record. If we cannot confirm the cancellation we tell you, and you can email us to finish it;
• you are signed out. Records that RevenueCat and Stripe must keep for legal or tax reasons may remain with them.

Turn off notification emails with the checkbox on your account page, or with the unsubscribe link at the bottom of any of those emails (it works without signing in). Both stop the emails right away. We do not send marketing email.

Choose your ad and cookie settings at any time with “Cookie & ad preferences” in the footer (section 3).

Other rights. Depending on where you live, you may have the right to access the personal information we hold about you, get a copy of it, correct it, delete it, object to or restrict certain processing, and withdraw consent you have given. You can change your username on your account page. For anything else, including access, a copy of your data, or deleting your voter email or a single bracket, email support.bracketbolt@gmail.com from the address on your account (or, for a voter email, the address you voted with). We may need to verify your identity, and we aim to respond within 30 days. If you cannot use the account page, you can also ask us by email to delete your account.

• EEA, UK and Switzerland (GDPR): you have the rights above and the right to complain to your local data protection authority. Our legal bases are performing our contract with you (providing the service), our legitimate interests (security, preventing abuse, improving the service) and, for advertising cookies, your consent, which you can withdraw at any time.
• California and other US states with privacy laws: you can ask to know, delete or correct personal information we hold about you. We do not sell personal information and do not currently share it for cross-context behavioral advertising, so there is nothing to opt out of today; you can still switch advertising off with “Cookie & ad preferences”. We will not discriminate against you for using these rights.

We use measures such as encrypted connections (HTTPS), passwords stored only as hashes (account passwords by Supabase, bracket passwords by us), hashed voter identifiers, rate limits, and database access rules that limit who can read votes. No system is perfectly secure, so we cannot guarantee absolute security.

BracketBolt is not directed to children. You must be at least 13 years old to use the service (or at least 16 where that is the minimum age under local law, such as in parts of the EEA), and you must be old enough to form a binding contract to buy a subscription. We do not knowingly collect personal information from children under these ages. If you believe a child has given us personal information, contact us and we will delete it.

We may update this policy as BracketBolt changes, for example when we add or change a service provider. We will post the new version here and update the “Last updated” date. If a change is significant we will try to notify you in the product or by email.

BracketBolt is operated from Pennsylvania, USA. Questions or requests about privacy? Email support.bracketbolt@gmail.com. See also our Terms of Service.